# Points External Secrets Operator at your Vault as a secrets backend.
# Auth is via the Kubernetes auth method (see the vault CLI commands run
# to set this up: `vault auth enable kubernetes`, the "external-secrets"
# role bound to the external-secrets ServiceAccount) — no long-lived Vault
# token stored anywhere; ESO authenticates dynamically using its own
# ServiceAccount's projected token each time it needs to read a secret.
#
# server uses Vault's internal cluster-DNS Service name, not the ingress
# host — this is pod-to-pod traffic, same reasoning as claude.md's
# "Pending" note about Jenkins pushing to Harbor via
# harbor-core.harbor.svc.cluster.local instead of going through Contour.
# tls_disable is set in Vault's own listener config (lab only), so this is
# http://, not https://.
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: vault-backend
spec:
  provider:
    vault:
      server: "http://vault.vault.svc.cluster.local:8200"
      path: "secret"
      version: "v2"
      auth:
        kubernetes:
          mountPath: "kubernetes"
          role: "external-secrets"
          serviceAccountRef:
            name: "external-secrets"
            namespace: "external-secrets"